What is confirmed about the flaws
The PHP project released fixed versions on 21 October 2026, and the CVE records describe two critical defects in PHP core. CVE-2026-109618 concerns an inconsistent state following an out-of-memory condition while a request is parsed. CVE-2026-109619 concerns state that may remain invalid after memory is released following a fatal error.
PHP and security-vendor materials describe both issues as potentially enabling unauthenticated remote code execution. Practical exploitability depends on how PHP is deployed and how the server is configured, so a maximum severity score should not be treated as a diagnosis for every installation.
Why crypto services should pay attention
Exchanges, wallets and other financial web services commonly use several layers: a public API, account pages, job queues, signing services and internal administration tools. A web-layer flaw does not by itself prove access to assets or private keys, but it can become an entry point for further intrusion into an operator's infrastructure.
There is no basis to assume that every crypto platform uses PHP or that a particular service has already been affected by these CVEs. The sound conclusion is narrower: when PHP is part of a public-facing financial product, patching and a review of privilege separation should be treated as urgent work.
A fix matters more than a workaround
The complete response is to move to a supported PHP release containing the fixes and restart affected processes in a controlled way. Before deployment, a team should confirm the PHP branch, deployment mode, extensions and rollback plan, then test critical customer journeys.
Vendor guidance may offer interim settings that reduce exposure, but those settings do not replace the patch. Older end-of-life branches need a separate decision: move to a supported release or obtain confirmation of a maintained distributor backport.
What users can do
A customer does not need to guess an exchange or wallet's technology stack from public clues. More useful habits are enabling two-factor authentication, avoiding password reuse, checking official notices and never entering credentials through links from unknown senders.
A technical vulnerability disclosure does not mean that a particular customer account has been compromised. If a service announces maintenance or an active-session reset, use only its official website or application rather than links sent in unsolicited messages.
